Change Details

This will give us several benefits over the LDAP based configuration. For this we will need to configure CAS as an OIDC authentity provider. https://datahubproject.io/docs/how/auth/sso/configure-oidc-react In order for this to happen we will need CAS version 6.5 installed as per T305518 first, then for CAS to be configured with OIDC specific configuration: Tasks IDP test: [x] configure OIDC in DataHub [x] network policy, communication between DataHub and CAS backend [] validate that the correct attributes are imported in DataHub Tasks Production: [] network policy, communication between DataHub and CAS backend AC: [] DataHub uses OIDC back by our usual backend [] user part of WMF and NDA group can connect [] required user attributes are imported on connection

This will give us several benefits over the LDAP based configuration. For this we will need to configure CAS as an OIDC authentity provider. https://datahubproject.io/docs/how/auth/sso/configure-oidc-react In order for this to happen we will need CAS version 6.5 installed as per T305518 first, then for CAS to be configured with OIDC specific configuration: Tasks IDP test: [x] configure OIDC variables in DataHub [x] network policy, communication between DataHub and CAS backend [x] successfully login to datahub-staging via SSO [x] validate that the correct attributes are imported in DataHub (email is correctly imported to the user profile, but groups are not. We might need to review how we handle groups) Tasks Production: [x] configure OIDC variables in DataHub [] network policy, communication between DataHub and CAS backend [] successfully login to Datahub production via SSO [] validate that the correct attributes are imported as expected in DataHub AC: [] DataHub uses OIDC back by our usual backend [] user part of WMF and NDA group can connect [] required user attributes are imported on connection

This will give us several benefits over the LDAP based configuration. For this we will need to configure CAS as an OIDC authentity provider. https://datahubproject.io/docs/how/auth/sso/configure-oidc-react In order for this to happen we will need CAS version 6.5 installed as per T305518 first, then for CAS to be configured with OIDC specific configuration: Tasks IDP test: [x] configure OIDC variables in DataHub [x] network policy, communication between DataHub and CAS backend [x] successfully login to datahub-staging via SSO [x] validate that the correct attributes are imported in DataHub (email is correctly imported to the user profile, but groups are not. We might need to review how we handle groups) Tasks Production: [x] configure OIDC variables in DataHub [] network policy, communication between DataHub and CAS backend [] successfully login to Datahub production via SSO [] validate that the correct attributes are imported as expected in DataHub AC: [] DataHub uses OIDC back by our usual backend [] user part of WMF and NDA group can connect [] required user attributes are imported on connection